A remotely triggerable command injection flaw in the device-information handler of TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 has a public exploit and a CVSS 3.1 score of 9.1 (Critical).
What Is It
CVE-2026-116505 is a command injection vulnerability (CWE-77, with the related CWE-74 for injection) in TOTOLINK A950RG router firmware. VulDB, the reporting CNA, places it in the getDeviceInfo function, which is tied to the file /var/lib/misc/udhcpd.leases in the device-information Handler component. An attacker can inject commands by manipulating the MAC address argument. The record says the attack can be launched remotely.
Why It Matters
The CNA scores this 9.1 Critical under CVSS 3.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The attack works over the network, has low complexity and needs no user interaction. The scope is marked Changed, with high impact to confidentiality, integrity and availability. The main limit is that the attacker needs high privileges (PR:H). Under CVSS 4.0 the score is 8.5 High, and exploit maturity is rated Proof-of-Concept.
The NVD description says "the exploit has been made public and could be used," and a public write-up is linked in the references. The supplied CISA KEV data has no entry for this CVE, so CISA has not confirmed active exploitation in the wild.
NVD lists the record as "Received" (published 2026-10-26), which means NVD has not yet done its own analysis. All scoring above comes from the CNA.
What's Vulnerable
- Vendor: TOTOLINK
- Product: A950RG
- Affected version: 4.1.2cu.5268_B20221104
- Component: device-information Handler
- CPE:
cpe:2.3:o:totolink:a950rg_firmware:*:*:*:*:*:*:*:*
The record does not say whether other firmware versions are affected.
Patch Status
The supplied data lists no fixed firmware version or vendor advisory. Since this CVE is not in KEV, there is no CISA required action or remediation due date. The references point only to the vendor's general site (totolink.net). Owners of A950RG devices running the affected build should check with TOTOLINK for updated firmware. Because the attack needs high privileges, also confirm who can reach the router's admin interface.